Privacy Policy

CHE Health and Wellbeing Ltd (“CHE”, “we”, “us” or “our”) is committed to protecting the privacy of all individuals whose personal data we hold. This Privacy Policy explains how we collect, use, share and protect your personal data when you visit our websites, use our mobile application (“the App”), enrol on our courses, or otherwise interact with our services.

We are registered as a data controller with the UK Information Commissioner’s Office (ICO) under registration number ZB035578. This policy complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

In this policy, “we”, “us” and “our” refer to CHE Health and Wellbeing Ltd (the data controller, registered in England and Wales No. 10722903), which is the group holding company for CHE Online Ltd, CHE London Ltd and CHE Pro Ltd. Where you interact with a specific CHE entity, that entity may act as data controller for your personal data in conjunction with CHE Health and Wellbeing Ltd.

When you visit our websites, we may collect:

- Usage data: IP address, browser type, operating system, pages visited, referral source, session duration and navigation paths.
- Account data: name, email address, and login credentials when you register for an account.
- Profile data: name, address, telephone number, gender, date of birth, educational history, employment details and profile picture.
- Enquiry data: information submitted through contact or enquiry forms.
- Transaction data: contact details, payment card details (processed via Stripe or PayPal) and purchase history.
- Correspondence data: content and metadata of communications you send us.
- Marketing data: email and communication preferences, and responses to newsletters.

We may receive personal data about you from third-party platforms including Kajabi and Thinkific (our learning platforms), ActiveCampaign (our CRM), ConvertFlow, and accreditation bodies where relevant to your enrolment.

We process your personal data on the following legal bases:

We do not sell your personal data. We may share it with:
- Group companies: CHE Health and Wellbeing Ltd (holding company), CHE Online Ltd, CHE London Ltd and CHE Pro Ltd, where necessary for the purposes described in this policy.
- Payment processors: Stripe and PayPal process card payments on our behalf. Their privacy policies are available at stripe.com/gb/privacy and paypal.com.
- Learning platforms: Kajabi and Thinkific host our online course content and hold student progress data.
- CRM and marketing: ActiveCampaign and ConvertFlow support student communications. ConvertFlow uses Amazon Web Services and FullContact for data enrichment, both of which operate appropriate safeguards.
- Teaching staff and lecturers: academic performance data is shared with lecturers and staff as necessary for educational administration.
- Accreditation and regulatory bodies: we may share relevant data with the Society of Homeopaths, Middlesex University or other accrediting bodies.
- Professional advisers and insurers: solicitors, accountants and insurers where necessary.
- Law enforcement or regulators: where required by law or to protect rights and safety.

Some of our service providers are based in the United States, including Stripe, PayPal, ActiveCampaign, ConvertFlow, Kajabi and Thinkific. Transfers to the USA are protected by Standard Contractual Clauses approved by the UK ICO (or equivalent UK adequacy mechanisms). You may obtain a copy of the relevant safeguards by contacting our Data Protection Officer.

The UK ICO’s guidance on international transfers is available at ico.org.uk.

We retain personal data only for as long as necessary. Our standard retention periods are:
- Student academic records (grades, attendance, assessments): minimum 3 years after graduation or leaving, maximum 5 years.
- Application forms: minimum 3 years after graduation or leaving, maximum 5 years.
- Transaction data: minimum 6 years (to comply with HMRC requirements).
- Enquiry data: minimum 12 months, maximum 24 months.
- Marketing email addresses: minimum 1 year, maximum 4 years (or until consent withdrawn).
- App usage logs and device data: maximum 12 months unless needed for ongoing dispute resolution.
- We may retain data longer where required by a legal obligation or to defend legal claims.

We implement appropriate technical and organisational measures to protect your personal data, including:
- Encryption of personal data in transit (TLS) and at rest.
- Access controls and role-based permissions to limit who can access your data.
- Regular security reviews and staff training.
- Secure hosting within the United Kingdom.
Despite our precautions, transmission of data over the internet carries inherent risk. Please protect your account password and notify us immediately if you suspect unauthorised access.

Our websites and App use cookies and similar technologies. We use:

- Strictly necessary cookies: essential for the website and App to function (no consent required).
- Analytics cookies: Google Analytics, Hotjar — to understand how users interact with our services. These require your consent.
- Marketing/advertising cookies: Google AdSense, Facebook, LinkedIn, Pinterest — to deliver relevant advertisements. These require your consent.
- Functional cookies: ConvertFlow, Tawk.to (live chat) — to personalise your experience.
- You can manage cookie preferences at any time via our cookie consent banner or your browser settings.

 Detailed cookie information is provided in our Cookie Notice, available on our website.

You have the following rights in relation to your personal data:

- Right of access: to receive a copy of the personal data we hold about you (Subject Access Request).
- Right to rectification: to have inaccurate or incomplete data corrected.
- Right to erasure (“right to be forgotten”): to request deletion of your data in certain circumstances.
- Right to restrict processing: to request that we limit how we use your data.
- Right to object: to object to processing based on legitimate interests or for direct marketing.
- Right to data portability: to receive your data in a structured, machine-readable format.
- Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting prior processing.
-- Right to complain: you have the right to lodge a complaint with the ICO (ico.org.uk, 0303 123 1113).

To exercise any of these rights, contact our Data Protection Officer at dpo@chehomeopathy.com, or write to us at the address below. We will respond within one calendar month.

Our services are directed at persons aged 18 and over. We do not knowingly collect personal data from individuals under 18. If we become aware that we hold personal data of a person under 18, we will delete it promptly.

Our websites and App may contain links to third-party websites. We are not responsible for the privacy practices of those sites and recommend you review their privacy policies before providing any personal data.

You have the right to request deletion of your personal data at any time, subject to our legal retention obligations.

- By email: send a deletion request to dpo@chehomeopathy.com with the subject line ‘Data Deletion Request’.
- By post: write to the Data Protection Officer at the address in Section 14.

We will delete or anonymise your data within 30 days and confirm this to you by email. Some data must be retained to comply with legal obligations (e.g. financial records for 6 years under HMRC requirements, academic records for up to 5 years for accreditation purposes). We will inform you of any such retention at the time of your request.

We may update this Privacy Policy from time to time. We will publish any changes on our website and, where changes are significant, notify you by email. The version date at the top of this document indicates when it was last updated.

If you have any questions about this policy or wish to exercise your rights, please contact: